Tabcorp has been fined AU$350,000 by the Victorian Gambling and Casino Control Commission (VGCCC), after failing to fully implement mandatory security controls intended to protect customer wagering accounts.
The regulator found Tabcorp VIC breached four Wagering and Betting Technical Standards between 30 January and 23 June 2025, because multi-factor authentication (MFA) had not been fully implemented across its wagering and betting system.
MFA requires customers to provide more than one form of authentication before accessing an account, adding another layer of protection against unauthorised access.
During the period of non-compliance, some Tabcorp customer accounts were accessed without authorisation, resulting in funds being withdrawn. The affected customers have since been reimbursed by either their banks or Tabcorp.
Tabcorp told the regulator that full implementation was completed in June 2025, including requiring remaining customers to upgrade to a version of the TAB app incorporating MFA.
The penalty adds to previous regulatory action against the operator in Victoria. In 2024, the VGCCC imposed an AU$4.6m fine and directed Tabcorp to undertake broader reforms covering compliance systems, governance and harm minimisation.
The latest enforcement action comes as Tabcorp continues to address financial crime controls while remaining subject to an ongoing AUSTRAC investigation.
Separately, the operator reported AU$2.64bn in FY26 group revenue, up 0.8% year on year, while EBITDA before significant items increased 10.3% to AU$431.7m. Statutory net profit after tax rose 26.5% to AU$46.3m.
Tabcorp is also pursuing its proposed acquisition of BetMakers Technology Group for an enterprise value of approximately AU$267m, with completion targeted for Q3 FY27 subject to required approvals.
The VGCCC previously fined Tabcorp AU$4.6m in 2024 over separate compliance breaches
